Leidos

Builds technology for defense and civil agencies

Insider Threat Program Hunt Analyst

Security Operations & Incident ResponseConfirmed live in the last 24 hours

Full-timeSpringfield, VA, USA$87.1k - $157.4kIn-person

About the Job

Requirements

A bachelor's degree and 4–8 years of prior relevant insider threat or other relevant experience are required; additional years of experience with requisite certifications may be considered in lieu of a degree.
At least four years of demonstrated knowledge of the intelligence cycle, analytic techniques, systems, processes, and organizations is required.
At least four years of demonstrated knowledge of threat assessment and mitigation strategies is required.
Strong written and verbal communication skills, including the ability to deliver briefings to diverse audiences, are required.
Knowledge of current domestic and international threats to U.S. national security interests is required.
The candidate must be able to establish networks with relevant security, personnel, and prevention stakeholders to foster program utilization.
The candidate must be capable of working independently to promote program goals.
Working knowledge of User Activity Monitoring (UAM) software and solutions is required.
Working knowledge of cybersecurity toolsets designed to support Insider Threat Program mission activities is required.
Working knowledge of open-source toolsets is required.
Working knowledge of insider threat frameworks, including Pathway to Violence and Critical Pathway, is required.
Current TS/SCI clearance and U.S. citizenship are required.
The candidate must be able to obtain DHS EOD SCI and be willing to undergo a CI polygraph.

Responsibilities

Examine, analyze, and search insider threat data to identify trends, patterns, and insights into potential insider threat indicators.
Provide analytical and program support services related to the operation of the UAM/UEBA tool.
Monitor the UAM platform to identify emerging requirements related to insider threat events and coordinate across the enterprise to ensure a timely response.
Research the UAM platform to identify patterns of concerning behavior related to potential insider threat risk to the DHS enterprise.
Conduct proactive insider threat-based hunting across the DHS enterprise network, using methodologies and behavioral analytics to detect, investigate, and mitigate anomalous activity and policy violations indicative of malicious insider behavior.
Conduct continuous hunt operations across data and log sources, DHS platforms, endpoint detection and response (EDR) tools, and network traffic to identify patterns of insider threat behavior.
Identify mitigation strategies to assist the investigative team in reducing insider threat risk.
Use UEBA platforms and techniques to baseline user activity and detect deviations.
Respond to critical/high UAM alerts within four hours during normal business hours.

Desired Qualifications

A master's degree from an accredited college or university in Criminal Justice, Homeland Security, Cyber Security, or a related field is preferred.
At least four years of experience in intelligence analysis is preferred.
Experience with User Activity Monitoring products and platforms is preferred.
At least four years of experience in threat assessment and mitigation is preferred.
Certified Counter-Insider Threat Professional – Fundamentals (CCITP-F) is preferred.
Certified Counter-Insider Threat Professional – Analysis (CCITP-A) is preferred.
Completion of the Center for Development of Security Excellence (CDSE) Insider Threat Detection Analysis Course (ITDAC) is preferred.
Completion of the Workplace Assessment of Violence Risk (WAVR-21) Workshop is preferred.
Completion of Center for Development of Security Excellence (CDSE) curricula INT311.CU, INT312.CU, and CI201.CU is preferred.

The Digital Sector at Leidos currently has an opening for a Hunt Analyst supporting the HEITS Contract as part of the Department of Homeland Security (DHS) Insider Threat Program (ITP). This is an exciting opportunity to use your experience to support, sustain, design and evolve the database backbone of the ITP. The ITP mission is to identify insider threats to the department by utilizing advanced analytics, monitoring, and data correlation which in turn help address and eliminate potential threat actors from compromising the DHS mission in safeguarding the homeland.

The selected candidate will be responsible for the following:

Examine, analyze, and search insider threat data to identify trends, patterns, and insights of potential insider threat indicators.
Provide analytical, program support services related to the operation of UAM/ UEBA tool.
Monitor UAM platform to identify emerging requirements related to insider threat events and coordinate across the enterprise to ensure timely response.
Conduct further research on the UAM platform to identify patterns of concerning behavior related to a potential insider threat risk to the DHS enterprise.
Provide proactive insider threat-based hunting across the DHS enterprise network, leveraging methodologies and behavioral analytics to detect, investigate, and mitigate anomalous activity and policy violations indicative of malicious insider behavior.
Conduct continuous hunt operations across data and log sources, DHS platforms, EDR tools, and network traffic to identify patterns of insider threat behavior.
Identify mitigation strategies to assist the investigative team in effectively reducing insider threat risk.
Utilize UEBA (User and Entity Behavior Analytics) platforms and techniques to baseline user activity and detect deviations.
Provide timely response to critical/high UAM alerts (within 4 hours during normal business hours).

Basic Qualifications:

Bachelors degree and 4-8 years of prior relevant insider threat experience or relevant experience. Additional years of experience with requisite certifications will be considered in leu of degree.
Minimum of 4 years demonstrated knowledge of the intelligence cycle, analytic techniques, systems, processes, and organizations.
Minimum of 4 years demonstrated knowledge of Threat Assessment & Mitigation Strategies.
Have excellent written and verbal skills with ability to deliver briefings to a diverse group of audiences.
Possess knowledge of current domestic and international threats to U.S. national security interests.
Be adept at establishing networks with relevant security, personnel, and prevention stakeholders to foster program utilization.

Be a self-starter capable of working independently to promote program goals.
Working knowledge of User Activity Monitoring Software (UAM) and solutions.
Working knowledge of Cybersecurity toolsets designed to support ITP mission activities.
Working Knowledge of Open-Source toolsets.
Working Knowledge of Insider Threat Frameworks; Pathway to Violence & Critical Pathway.
Current TS/SCI and Must be a US Citizen.
Ability to obtain DHS EOD SCI and willingness to undergo CI Polygraph.

Preferred Qualifications:

Master’s degree from an accredited college or university in Criminal Justice, Homeland security, Cyber Security, or related field
Proven experience (4+ years) in Intelligence Analysis
Experience with User Activity Monitoring products and platforms
Proven experience (4+ years) in Threat Assessment & Mitigation
Certified Counter-Insider Threat Professional - Fundamentals (CCITP-F)
Certified Counter-Insider Threat Professional - Analysis (CCITP-A)
Completion of Center for Development of Security Excellence (CDSE) Insider Threat Detection Analysis Course (ITDAC)
Completion of Workplace Assessment of Violence Risk (WAVR-21) Workshop
Completion of Center for Development of Security Excellence (CDSE) Curriculums; INT311.CU/INT312.CU/CI201.CU

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.

Original Posting:

October 21, 2026

For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.

Pay Range:

Pay Range $87,100.00 - $157,450.00

The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

About the Company

Leidos

Builds technology for defense and civil agencies

Leidos develops technology and runs services for defense, intelligence and civilian agencies, as well as healthcare and commercial customers. It combines software and engineering work with systems integration, building secure networks and equipment used in demanding operations. Its portfolio includes medical services, energy infrastructure design and technology that supports military missions, linking specialist businesses under one parent. Customers pay through contracts for delivered systems and services, with payment tied to labor, costs or agreed project milestones. Leidos traces its roots to a company founded in 1969 and is headquartered in Reston, Virginia.

Company size: 10,001+
Company stage: IPO
Headquarters: Reston, VA
Founded: 1969

Recently Posted Jobs

Explore more opportunities at Leidos

See more jobs